Security audit
Security checks for vulnerabilities and agentic risk
The TikTok workflow uses official APIs, defaults to drafts, and requires approval before uploading.
Review the separately required socialkit-social-core skill before use. Keep authentication scoped to TikTok; the shared auth command's other service options are unnecessary for this workflow. Check the account, video, and privacy settings before approving. Protect the local credential directory and revoke the app's account access when finished; uninstalling the skill does not revoke OAuth grants.
Referenced artifact was not completely inspected
- Direct mode: run `node scripts/auth.mjs --platform tiktok --creator-info`, show the creator nickname and privacy options, and let the user choose privacy and
Referenced artifact was not completely inspected
1. Sign in once (browser, local redirect): `node scripts/auth.mjs --platform tiktok`
Referenced artifact was not completely inspected
3. Write `post.json` (text, media with alt text, options). See `node scripts/publish.mjs --help`.
Referenced artifact was not completely inspected
4. Validate: `node scripts/publish.mjs --check --dir tt-<slug>`
Referenced artifact was not completely inspected
6. Publish: `node scripts/publish.mjs --publish --dir tt-<slug>` and report the result.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Sign in
`node scripts/auth.mjs --platform tiktok` (PKCE). Access tokens last 24 hours and refresh
automatically for a year.
## Rules this skill enforces (Content Sharing Guidelines)
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
return v;
}
function apiBase(env) {
return env[PIN_ENV.sandbox] === "1" ? "https://api-sandbox.pinterest.com/v5" : "https://api.pinterest.com/v5";
}
function basic(env) {
return {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
async function finishPinterestLogin(pastedUrl, env = process.env, fetchImpl) {
const { code, redirectUri } = finishPasteback("pinterest", pastedUrl, env);
const res = await postForm(
"https://api.pinterest.com/v5/oauth/token",
{ grant_type: "authorization_code", code, redirect_uri: redirectUri, continuous_refresh: "true" },
basic(env),
fetchImpl
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"pinterest",
async (t) => toToken(
await postForm(
"https://api.pinterest.com/v5/oauth/token",
{ grant_type: "refresh_token", refresh_token: t.refreshToken },
basic(env)
),
The CLI actively dispatches to X, LinkedIn, and Pinterest authentication flows and can list Pinterest boards (L1309–L1337); these are reachable operations, not merely unused bundled functions. Those flows request non-TikTok permissions, including social-posting or board/pin write scopes (L0413, L0601, L1040), and persist the resulting credentials. Access to these accounts is unjustified for a skill whose stated purpose is exclusively uploading or posting TikTok videos.